VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Problem s virem JS/Kryptik.I

https://forum.viry.cz:443/viewtopic.php?t=140282

Stránka 1 z 1

Problem s virem JS/Kryptik.I

Napsal: 16 zář 2014 16:53
od qantas
Dobrý den,

prosím o pomoc, při používání Firefoxu mě NOD32 zahlásí že blokuje tento vir a uloží do karantény, bohužel situace se stále opakuje a neumí jej odstranit, prosím tedy o pomoc, níže zasílám log :
Děkuji

Logfile of random's system information tool 1.10 (written by random/random)
Run by Niki at 2014-09-16 17:37:11
Microsoft Windows 7 Enterprise Service Pack 1
System drive C: has 28 GB (19%) free of 153 GB
Total RAM: 3579 MB (60% free)


======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA1cf9093dca0eeef.job - C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default

prefs.js - "browser.search.useDBForOrder" - "false"
prefs.js - "browser.startup.homepage" - "https://www.google.cz/?gws_rd=ssl"
prefs.js - "keyword.URL" - "http://www.default-search.net/search?si ... &src=ds&p="

"{336D0C35-8A85-403a-B9D2-65C292C39087}"=C:\Program Files\IB Updater\Firefox


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.152 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.8]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\extensions\
{cc6cc772-f121-49e0-b1f0-c26583cb0c5e}

C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\searchplugins\
default-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
IB Updater - C:\Program Files\IB Updater\Extension32.dll [2012-11-20 170840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2013-04-20 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2012-03-20 1056320]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Guard.Mail.ru.gui"=C:\Program Files\Guard-ICQ\GuardICQ.exe [2012-07-20 1564368]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-10-08 1934632]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-10-23 5074384]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"NPSStartup"= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ICQ"=C:\Program Files\ICQ7M\ICQ.exe [2012-07-20 127040]
"DU Meter"=C:\Program Files\DU Meter\DUMeter.exe [2009-08-07 2647064]
"DAEMON Tools Pro Agent"=C:\Program Files\DAEMON Tools Pro\DTAgent.exe [2012-04-26 3111744]
"KiesPreload"=C:\Program Files\Samsung\Kies\Kies.exe /preload []
"KiesPDLR.exe"=C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run []
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2014-07-24 21650016]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-09-16 17:36:19 ----D---- C:\Program Files\trend micro
2014-09-16 17:36:18 ----D---- C:\rsit
2014-09-16 07:36:16 ----ASH---- C:\pagefile.sys
2014-09-12 23:57:20 ----D---- C:\Program Files\Mozilla Firefox
2014-09-12 03:13:36 ----A---- C:\Windows\system32\iesetup.dll
2014-09-12 03:13:34 ----A---- C:\Windows\system32\ieui.dll
2014-09-12 03:13:33 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-09-12 03:13:33 ----A---- C:\Windows\system32\jscript9diag.dll
2014-09-12 03:13:32 ----A---- C:\Windows\system32\msrating.dll
2014-09-12 03:13:32 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 03:13:31 ----A---- C:\Windows\system32\mshtmled.dll
2014-09-12 03:13:31 ----A---- C:\Windows\system32\jsproxy.dll
2014-09-12 03:13:31 ----A---- C:\Windows\system32\ieUnatt.exe
2014-09-12 03:13:31 ----A---- C:\Windows\system32\ieapfltr.dll
2014-09-12 03:13:31 ----A---- C:\Windows\system32\dxtmsft.dll
2014-09-12 03:13:30 ----A---- C:\Windows\system32\vbscript.dll
2014-09-12 03:13:30 ----A---- C:\Windows\system32\iernonce.dll
2014-09-12 03:13:30 ----A---- C:\Windows\system32\dxtrans.dll
2014-09-12 03:13:29 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 03:13:28 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 03:13:28 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-09-12 03:13:28 ----A---- C:\Windows\system32\msfeeds.dll
2014-09-12 03:13:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-09-12 03:13:28 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-09-12 03:13:27 ----A---- C:\Windows\system32\iedkcs32.dll
2014-09-12 03:13:27 ----A---- C:\Windows\system32\ie4uinit.exe
2014-09-12 03:13:24 ----A---- C:\Windows\system32\iertutil.dll
2014-09-12 03:13:23 ----A---- C:\Windows\system32\wininet.dll
2014-09-12 03:13:22 ----A---- C:\Windows\system32\jscript9.dll
2014-09-12 03:13:21 ----A---- C:\Windows\system32\urlmon.dll
2014-09-12 03:13:18 ----A---- C:\Windows\system32\mshtml.dll
2014-09-12 03:13:17 ----A---- C:\Windows\system32\ieframe.dll
2014-09-12 03:12:37 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2014-09-11 21:28:21 ----D---- C:\Users\Niki\AppData\Roaming\FirefoxToolbar
2014-09-11 21:28:10 ----D---- C:\Program Files\Settings Manager
2014-09-11 21:28:00 ----D---- C:\ProgramData\smdmf
2014-09-11 21:27:53 ----D---- C:\Users\Niki\AppData\Roaming\WebExtend
2014-09-11 20:51:32 ----A---- C:\Windows\system32\TSWorkspace.dll
2014-09-11 20:50:39 ----A---- C:\Windows\system32\lsasrv.dll
2014-09-11 20:50:39 ----A---- C:\Windows\system32\kerberos.dll
2014-09-11 20:50:32 ----A---- C:\Windows\system32\d3d10warp.dll
2014-09-11 20:50:05 ----A---- C:\Windows\system32\aepdu.dll
2014-09-11 20:50:05 ----A---- C:\Windows\system32\aeinv.dll
2014-08-28 08:46:17 ----A---- C:\Windows\system32\win32k.sys
2014-08-28 08:46:16 ----A---- C:\Windows\system32\gdi32.dll
2014-08-22 08:26:01 ----A---- C:\Windows\system32\wups2.dll
2014-08-22 08:26:01 ----A---- C:\Windows\system32\wuauclt.exe
2014-08-22 08:26:00 ----A---- C:\Windows\system32\wucltux.dll
2014-08-22 08:26:00 ----A---- C:\Windows\system32\wuaueng.dll
2014-08-22 08:25:43 ----A---- C:\Windows\system32\wups.dll
2014-08-22 08:25:43 ----A---- C:\Windows\system32\wudriver.dll
2014-08-22 08:25:43 ----A---- C:\Windows\system32\wuapi.dll
2014-08-22 08:25:28 ----A---- C:\Windows\system32\wuwebv.dll
2014-08-22 08:25:28 ----A---- C:\Windows\system32\wuapp.exe

======List of files/folders modified in the last 1 month======

2014-09-16 17:37:22 ----D---- C:\Windows\Prefetch
2014-09-16 17:37:14 ----D---- C:\Windows\Temp
2014-09-16 17:36:19 ----RD---- C:\Program Files
2014-09-16 17:35:45 ----SHD---- C:\System Volume Information
2014-09-16 17:21:53 ----SHD---- C:\Windows\Installer
2014-09-16 17:21:50 ----D---- C:\ProgramData\Skype
2014-09-16 09:59:14 ----D---- C:\Windows\system32\config
2014-09-16 07:38:17 ----D---- C:\Users\Niki\AppData\Roaming\Skype
2014-09-16 07:37:06 ----D---- C:\Users\Niki\AppData\Roaming\ICQ
2014-09-15 23:39:13 ----D---- C:\Windows\system32\catroot
2014-09-15 21:46:29 ----D---- C:\Program Files\DU Meter
2014-09-14 19:09:16 ----D---- C:\Users\Niki\AppData\Roaming\Samsung
2014-09-14 19:09:04 ----D---- C:\Windows\system32\DriverStore
2014-09-14 19:09:04 ----D---- C:\Windows\inf
2014-09-14 19:09:03 ----D---- C:\Windows\system32\catroot2
2014-09-14 19:08:45 ----D---- C:\Windows\system32\drivers
2014-09-14 19:05:03 ----D---- C:\Windows\Microsoft.NET
2014-09-14 19:03:52 ----D---- C:\Windows\System32
2014-09-14 19:03:11 ----D---- C:\Windows\system32\Tasks
2014-09-14 18:56:45 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-09-14 18:54:33 ----D---- C:\Program Files\Golden FTP Server Pro
2014-09-14 18:54:23 ----HD---- C:\ProgramData
2014-09-14 18:53:55 ----D---- C:\Program Files\Codebox
2014-09-14 18:36:36 ----D---- C:\Users\Niki\AppData\Roaming\uTorrent
2014-09-14 18:35:03 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-09-12 04:21:34 ----D---- C:\Windows\rescache
2014-09-12 03:47:07 ----RSD---- C:\Windows\assembly
2014-09-12 03:33:02 ----D---- C:\Windows\winsxs
2014-09-12 03:30:12 ----D---- C:\Windows\system32\en-US
2014-09-12 03:30:11 ----D---- C:\Program Files\Internet Explorer
2014-09-12 03:12:36 ----D---- C:\Windows\system32\MRT
2014-09-12 03:07:46 ----A---- C:\Windows\system32\MRT.exe
2014-09-12 03:07:19 ----SD---- C:\Windows\system32\CompatTel
2014-09-11 22:41:03 ----D---- C:\Users\Niki\AppData\Roaming\vlc
2014-09-10 11:01:16 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-08-31 18:50:57 ----D---- C:\FILMY-NEW
2014-08-29 10:48:33 ----D---- C:\Windows\system32\cs-CZ
2014-08-17 09:43:59 ----D---- C:\Windows\PolicyDefinitions

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-11-21 242240]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-10-08 170656]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-10-08 121216]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-10-08 104712]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-05-24 7800832]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-05-24 245760]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2012-07-20 4256320]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-10-08 1314736]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2014-01-23 88576]
S3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter; C:\Windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 603240]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-18 65432]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-05-24 176128]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 DUMeterSvc;DU Meter Service; C:\Program Files\DU Meter\DUMeterSvc.exe [2009-08-07 1387544]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2012-10-23 1329304]
R2 Guard.Mail.ru;Guard.Mail.ru; C:\Program Files\Guard-ICQ\GuardICQ.exe [2012-07-20 1564368]
R2 IB Updater;IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [2012-11-20 188760]
R2 ICQ Service;ICQ Service; C:\PROGRA~1\ICQ6TO~1\ICQSER~1.EXE [2012-03-20 247872]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-07-23 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-10-23 172192]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-07-23 116648]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-08-18 108032]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-09-12 114288]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-07-22 1343400]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Re: Problem s virem JS/Kryptik.I

Napsal: 16 zář 2014 17:10
od vyosek
Zdravim :)

:arrow: Jen se s dovolenim zeptam, kde jste prisel k verzi Windows 7 Enterprise, ktery neni bezne k zakoupeni a je urcen pro firemni klientelu??

Re: Problem s virem JS/Kryptik.I

Napsal: 16 zář 2014 17:14
od qantas
Dobrý den,

využívám svůj NTB i pro firemní záležitosti.

Re: Problem s virem JS/Kryptik.I

Napsal: 17 zář 2014 05:11
od vyosek
:arrow: Udelejte sken MBAMem dle tohoto http://forum.viry.cz/viewtopic.php?f=29&t=137928

Re: Problem s virem JS/Kryptik.I

Napsal: 18 zář 2014 21:45
od qantas
přikládám sken z MBAMem :

díky

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 18.9.2014
Čas skenování: 20:26:32
Protokol: logg.txt
Správce: Ano

Verze: 2.00.2.1012
Databáze malwaru: v2014.09.18.06
Databáze rootkitů: v2014.09.18.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Self-protection: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: Niki

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 450789
Uplynulý čas: 2 hod, 13 min, 35 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristics: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 1
PUP.Optional.SweetPacks.A, C:\Program Files\IB Updater\ExtensionUpdaterService.exe, 1816, , [40de7d72fe7de1552fc2b75f4db4ec14]

Moduly: 0
(No malicious items detected)

Klíče registru: 17
PUP.Optional.SweetPacks.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IB Updater, , [40de7d72fe7de1552fc2b75f4db4ec14],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\CLASSES\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\CLASSES\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}\INPROCSERVER32, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\CLASSES\Extension.ExtensionHelperObject.1, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\CLASSES\Extension.ExtensionHelperObject, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{336D0C35-8A85-403A-B9D2-65C292C39087}, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{336D0C35-8A85-403A-B9D2-65C292C39087}, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.StartPage.A, HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{336D0C35-8A85-403A-B9D2-65C292C39087}, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\IB Updater, , [b36b5b9429524ceadeef2bf99c6722de],
PUP.Optional.SettingsManager.A, HKLM\SOFTWARE\SmdmF, , [1806a847c1ba57dfe030cb3e9c67aa56],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, , [ea34c728f18a8da9f2da859f33d0c040],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\WOW6432NODE\IB Updater, , [47d7d01f611a5bdb4a835bc936cd58a8],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, , [cf4f9857017a3501fdcf8e96a95ac43c],
PUP.Optional.SettingsManager.A, HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SmdmF, , [1b03fef1bdbe0b2b9b747b8e72919868],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [3ce2b43b443737ff28256abcb0531ee2],

Hodnoty registru: 6
PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\IB Updater\Firefox, , [fb23e20d4f2cad895c15820562a039c7]
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\IB Updater\Firefox, , [fb23e20d4f2cad895c15820562a039c7]
PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [f52935ba85f659dd630ebfc8fe04fb05],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [31ed04ebc4b7d95d7ef3c8bfe31fc13f],
PUP.Optional.SettingsManager, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\APPCERTDLLS|x86, C:\Program Files\Settings Manager\smdmf\sysapcrt.dll, , [140add12accf50e6d4c5f41812f1867a]
PUP.Optional.IBUpdater, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IB UPDATER|ImagePath, C:\Program Files\IB Updater\ExtensionUpdaterService.exe, , [c45a12dd3744e3537470f860689c6a96]

Data registru: 0
(No malicious items detected)

Složky: 19
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\content, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\content\libraries, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\content\resources, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\locale, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\locale\en-US, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\skin, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\defaults, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\defaults\preferences, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\libraries, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\resources, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.SettingsManager.A, C:\Program Files\Settings Manager\smdmf, , [bf5f19d65a2149ede81bfff239c99c64],
PUP.Optional.SettingsManager.A, C:\ProgramData\smdmf, , [938b6f80ec8f45f15261ce28b2508d73],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content, , [ec3245aa9ddef83edcd807ef847ef20e],

Soubory: 83
PUP.Optional.SweetPacks.A, C:\Program Files\IB Updater\ExtensionUpdaterService.exe, , [40de7d72fe7de1552fc2b75f4db4ec14],
PUP.Optional.StartPage.A, C:\Program Files\IB Updater\Extension32.dll, , [fb23e20d4f2cad895c15820562a039c7],
PUP.Optional.Softonic, C:\Users\Niki\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0547H550\kmplayer_downloader[2].exe, , [c35b509f6e0d71c5d03e48cd47bacd33],
PUP.Optional.BPlug, C:\Users\Niki\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OPG0VLOL\EnhanceEmpire_20140828055115_4381[1].exe, , [8f8fc8278bf0c5717a09e9d10af741bf],
PUP.Optional.Softonic.A, C:\Users\Niki\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OPG0VLOL\kmplayer_downloader[1].exe, , [07173cb3b6c5e45209633bf58a770df3],
PUP.Optional.Softonic.A, C:\Users\Niki\AppData\Local\Temp\KMP_3.4.0.59.exe, , [d04e658a1c5f46f01e4e59d7966b21df],
PUP.Optional.Softonic, C:\Users\Niki\AppData\Local\Temp\KMP_3.5.0.77.exe, , [f529826d7dfe1e18c84620f52dd4fe02],
PUP.Optional.Softonic, C:\Users\Niki\AppData\Local\Temp\KMP_3.6.0.87.exe, , [0816559ac5b677bf2ae434e18d74867a],
PUP.Optional.Softonic, C:\Users\Niki\AppData\Local\Temp\KMP_3.7.0.109.exe, , [fe20f2fd83f825112ce20e07f80926da],
PUP.Optional.Softonic.A, C:\Users\Niki\AppData\Local\Temp\KMP_3.8.0.121.exe, , [57c74ba4d1aa0432beae86aa51b01ce4],
PUP.Optional.Softonic.A, C:\Users\Niki\AppData\Local\Temp\KMP_3.9.0.124.exe, , [f8265f90d2a9b97d7bf17fb12dd49e62],
PUP.Optional.Softonic.A, C:\Users\Niki\AppData\Local\Temp\KMP_3.9.0.125.exe, , [60bec9260f6cc96d95d7a8887c85c040],
PUP.Optional.Softonic, C:\Users\Niki\AppData\Local\Temp\KMP_3.9.0.127.exe, , [40de2dc22952ea4c6142f5c2ea174cb4],
PUP.Optional.Softonic.A, C:\Users\Niki\AppData\Local\Temp\KMP_3.7.0.113.exe, , [8896d8174f2c0b2bc9a3d95758a9df21],
PUP.Optional.Linkey.A, C:\Users\Niki\AppData\Local\Temp\SettingsManagerSetup.exe, , [cf4fdf10f586d85ee930663149b8d030],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF15.dll, , [8e90a24d81fa5adccea78323aa57738d],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF10.dll, , [8c92549b4635f73fb3c28f172ad746ba],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF11.dll, , [fc22905fe695b680542184220bf68977],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF12.dll, , [f82615da86f5fe38e78e9f076a977789],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF13.dll, , [5ac448a778035bdbe2937c2a966b8779],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF14.dll, , [ba649758d5a6fe38cea78323c43d02fe],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF16.dll, , [c25ca6495d1efc3ab4c12680a45d5ca4],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF17.dll, , [5dc12cc3e299df571c5902a442bf926e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF18.dll, , [7ca238b7e5968ea85025d6d0ad54a45c],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF19.dll, , [d34bb43bf18aa49252236a3ca06151af],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF2.dll, , [1fff6b84f08bb4824a2be2c488794fb1],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF20.dll, , [bc629659106b46f0cca9a7ffc33eb54b],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF21.dll, , [bf5f10df80fb63d303724a5c9e63d42c],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF22.dll, , [001e18d7c9b28aacfb7a3a6c34cdf907],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF23.dll, , [938b747b02796bcb4233e3c355ac4db3],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF24.dll, , [72ac8e61a7d4dd59363f74320ef3b54b],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF25.dll, , [8d919d520e6dd75f3b3a1393629fdf21],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF26.dll, , [f02ed9169ae188aebeb711954db4ba46],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF27.dll, , [948a24cbcbb0a096bcb9b2f4c04106fa],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF28.dll, , [21fd18d7750676c08aeb4264fd041be5],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF29.dll, , [938bc9266318cc6a462f5254f40d23dd],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF30.dll, , [908e905f0a71c76f98dd7630d72ab34d],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF31.dll, , [0e1023cc2d4e3cfa5f169412a75adf21],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF32.dll, , [3ae405eaea9158de7cf9644243be4db3],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF4.dll, , [38e69f503e3d1c1ad0a5f2b47b86b947],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF5.dll, , [52cccc23c9b29e98304515918e73768a],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF6.dll, , [4ad47c73186345f1f5808224eb16ce32],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF7.dll, , [918dcf201c5fbe78afc6159135cc758b],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF8.dll, , [cd519b54f9823006294cccda5aa734cc],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF9.dll, , [ca54ab44d2a925110d68644246bb4cb4],
PUP.Optional.Linkey.A, C:\Program Files\Settings Manager\smdmf\tbicon.exe, , [3be309e60a71bc7a997ff5a2c43d6c94],
PUP.Optional.Linkey.A, C:\Program Files\Settings Manager\smdmf\Uninstall.exe, , [0c124aa5e19a56e0ae6b4b4c23dec937],
PUP.Optional.OpenCandy, D:\Torenty\Software\Daemon.Tools.Pro.Advanced.v5.2.0.0348.Multilingual.Cracked-BRD\DAEMONToolsPro520-0348.exe, , [3ae46788a2d9d561f75bcf5a798c1ee2],
PUP.Riskware.Patcher, D:\Torenty\Software\Daemon.Tools.Pro.Advanced.v5.2.0.0348.Multilingual.Cracked-BRD\Patch.exe, , [52cc87683e3d44f2b9f167aa6d94bc44],
RiskWare.Tool.CK, D:\Torenty\Software\Garmin mapy TOPO CZ+SK+EUROPE+CYKLO\gmkgn15final\garmin_kgen.exe, , [968839b64c2f77bfa7bee03fe61c21df],
PUP.Optional.DefaultSearch.A, C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\searchplugins\default-search.xml, , [829cdf10a7d4c3732accd851cd362fd1],
PUP.Optional.DefaultSearch.A, C:\Program Files\Mozilla Firefox\browser\searchplugins\default-search.xml, , [da448669b4c7d26404f3eb3ec73c7888],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome.manifest, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\install.rdf, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\content\main.js, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\content\main.xul, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\content\libraries\DataExchangeScript.js, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\content\resources\localscript.js, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\locale\en-US\overlay.dtd, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\chrome\skin\overlay.css, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\Firefox\defaults\preferences\defaults.js, , [72acaf402e4d1224db0ac60ff70bf50b],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\InstallerHelper.dll, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\source.crx, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\unins000.dat, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\unins000.exe, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\libraries\DataExchangeScript.js, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.IBUpdater, C:\Program Files\IB Updater\resources\localscript.js, , [61bd21ce116a1a1c53392abeb84a1ce4],
PUP.Optional.SettingsManager.A, C:\Program Files\Settings Manager\smdmf\Helper.dll, , [bf5f19d65a2149ede81bfff239c99c64],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\chrome.manifest, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\install.rdf, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF.xpt, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\DnsBHO.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\Error404BHO.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\MainBHO.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\NativeHelper.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\NewTabBHO.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\overlay.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\overlay.xul, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\RelatedSearch.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\RequestPreserver.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\SearchBHO.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.SettingsManager.A, C:\Users\Niki\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\content\SettingManager.js, , [ec3245aa9ddef83edcd807ef847ef20e],
PUP.Optional.DefaultSearch.A, C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\prefs.js, Dobré: (), Špatné: (user_pref("keyword.URL", "http://www.default-search.net/search?si ... &src=ds&p=");), ,[4ed032bd8eedea4cdb196ec85ca97e82]

Fyzické sektory: 0
(No malicious items detected)


(end)

Re: Problem s virem JS/Kryptik.I

Napsal: 19 zář 2014 08:37
od vyosek
:arrow: Nalezy smazte

:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

Re: Problem s virem JS/Kryptik.I

Napsal: 20 zář 2014 17:32
od qantas
přikládám LOG :

# AdwCleaner v3.310 - Report created 20/09/2014 at 18:28:03
# Updated 12/09/2014 by Xplode
# Operating System : Windows 7 Enterprise Service Pack 1 (32 bits)
# Username : Niki - NIKI-PC
# Running from : C:\Users\Niki\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G3H42N2U\adwcleaner_3.310.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : ICQ Service

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\ICQ\ICQToolbar
Folder Deleted : C:\Program Files\ICQ6Toolbar
Folder Deleted : C:\Program Files\Settings Manager
Folder Deleted : C:\Users\Niki\AppData\Roaming\FirefoxToolbar
Folder Deleted : C:\Users\Niki\AppData\Roaming\WebExtend

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Key Deleted : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Key Deleted : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\ICQ\ICQToolbar
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\Linkey
Key Deleted : HKCU\Software\Myfree Codec
Key Deleted : HKCU\Software\PIP
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\ICQ\ICQToolbar
Key Deleted : HKLM\SOFTWARE\ImInstaller
Key Deleted : HKLM\SOFTWARE\PIP

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17280

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v32.0.2 (x86 cs)

[ File : C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\prefs.js ]

Line Deleted : user_pref("browser.search.order.1", "default-search.net");

*************************

AdwCleaner[R0].txt - [3060 octets] - [20/09/2014 18:21:58]
AdwCleaner[S0].txt - [2981 octets] - [20/09/2014 18:28:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3041 octets] ##########

Re: Problem s virem JS/Kryptik.I

Napsal: 20 zář 2014 21:54
od vyosek
:arrow: Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;
  • Nasledne kliknete na Run Script
  • PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Re: Problem s virem JS/Kryptik.I

Napsal: 21 zář 2014 15:46
od qantas
přikládám LOG :


Zoek.exe v5.0.0.0 Updated 20-September-2014
Tool run by Niki on ne 21.09.2014 at 16:18:44,36.
Microsoft Windows 7 Enterprise 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Niki\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

21.9.2014 16:20:00 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.cz/?gws_rd=ssl");
user_pref("browser.search.useDBForOrder", "false");

Added to C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\Niki\AppData\Roaming\Thunderbird\Profiles\nqgbxoik.default\prefs.js:

Added to C:\Users\Niki\AppData\Roaming\Thunderbird\Profiles\nqgbxoik.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\Program Files\Java deleted
C:\Users\Niki\AppData\Roaming\iLauncher deleted
C:\Users\Niki\AppData\Roaming\iLinker deleted
C:\Users\Niki\AppData\Roaming\ICQ Search deleted
C:\PROGRA~2\ICQ deleted
C:\Windows\system32\config\systemprofile\Searches deleted
C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default\extensions\{cc6cc772-f121-49e0-b1f0-c26583cb0c5e} deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Niki\AppData\Roaming\Thunderbird\Profiles\nqgbxoik.default
- Instrument Test - %ProfilePath%\extensions\tbtestpilot@labs.mozilla.com.xpi

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default
DFC9460CC37E5C414DC4680B10C19E7A - C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll - Shockwave Flash
0CA4180B21C6B728578F3B0433BB740E - C:\Program Files\VideoLAN\VLC\npvlc.dll - VLC Web Plugin
FB5621842FDABF9F8359775573498FBC - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll - Google Update
3220B1254AEF7A191187EC03F51B3D61 - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
B2576571746839180833E048AC2CCA5C - C:\Program Files\Adobe\Reader 10.0\Reader\browser\nppdf32.dll - Adobe Acrobat
5B92CB0A3EEE50F6B9AE036B4F9B0F0C - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll - Google Earth Plugin
D493C8FC0D0FD015BB9765658D77346E - C:\Users\Niki\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.cz/"
"ICQ Search"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"ICQ Search"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="https://www.google.cz/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

Nothing found to reset

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3225356497-680086398-3201549040-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
HKEY_USERS\S-1-5-21-3225356497-680086398-3201549040-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Empty IE Cache ======================

C:\Users\Niki\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Niki\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Niki\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Niki\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache is not empty, a reboot is needed

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=650 folders=53 100243955 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Niki\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Niki\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Niki\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AYXLDNU7\doma.nova.cz" not found
"C:\Users\Niki\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AYXLDNU7\files.crazygames.com" not found
"C:\Users\Niki\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AYXLDNU7\ph-static.phncdn.com" not found
"C:\Users\Niki\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AYXLDNU7\www.nowgamez.net" not found
"C:\Users\Niki\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AYXLDNU7\www.portalsvj.cz" not found
"C:\Users\Niki\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AYXLDNU7\www.webgames.cz" not found

==== EOF on ne 21.09.2014 at 16:44:08,51 ======================

Re: Problem s virem JS/Kryptik.I

Napsal: 21 zář 2014 19:57
od vyosek
Poprosim o FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

Re: Problem s virem JS/Kryptik.I

Napsal: 22 zář 2014 16:07
od qantas
přikládám log z FRST :

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-09-2014 01
Ran by Niki (administrator) on NIKI-PC on 22-09-2014 17:01:20
Running from C:\Users\Niki\Desktop
Platform: Microsoft Windows 7 Enterprise Service Pack 1 (X86) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Hagel Technologies Ltd) C:\Program Files\DU Meter\DUMeterSvc.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
() C:\Program Files\Guard-ICQ\GuardICQ.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
() C:\Program Files\Guard-ICQ\GuardICQ.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(ICQ, LLC.) C:\Program Files\ICQ7M\ICQ.exe
(Hagel Technologies Ltd) C:\Program Files\DU Meter\DUMeter.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_15_0_0_152_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(forum.viry.cz) C:\Users\Niki\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Guard.Mail.ru.gui] => C:\Program Files\Guard-ICQ\GuardICQ.exe [1564368 2012-07-20] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1934632 2010-10-08] (Synaptics Incorporated)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5074384 2012-10-23] (ESET)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [249064 2010-10-29] (Sun Microsystems, Inc.)
HKLM\...\Run: [NPSStartup] => [X]
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [ICQ] => C:\Program Files\ICQ7M\ICQ.exe [127040 2012-07-20] (ICQ, LLC.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [DU Meter] => C:\Program Files\DU Meter\DUMeter.exe [2647064 2009-08-07] (Hagel Technologies Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files\DAEMON Tools Pro\DTAgent.exe [3111744 2012-04-26] (DT Soft Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe /preload
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c} - H:\iLinker.exe
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ICQ] => C:\Program Files\ICQ7M\ICQ.exe [127040 2012-07-20] (ICQ, LLC.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DU Meter] => C:\Program Files\DU Meter\DUMeter.exe [2647064 2009-08-07] (Hagel Technologies Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files\DAEMON Tools Pro\DTAgent.exe [3111744 2012-04-26] (DT Soft Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe /preload
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c} - H:\iLinker.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/
URLSearchHook: HKCU - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://javadl-esd.oracle.com/update/1.6 ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Niki\AppData\Roaming\Mozilla\Firefox\Profiles\0u20p2rx.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Niki\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012-11-07]

Chrome:
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DUMeterSvc; C:\Program Files\DU Meter\DUMeterSvc.exe [1387544 2009-08-07] (Hagel Technologies Ltd)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1329304 2012-10-23] (ESET)
R2 Guard.Mail.ru; C:\Program Files\Guard-ICQ\GuardICQ.exe [1564368 2012-07-20] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-21] (DT Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [170656 2012-10-08] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [121216 2012-10-08] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [104712 2012-10-08] (ESET)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-22] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-22 17:01 - 2014-09-22 17:01 - 00011122 _____ () C:\Users\Niki\Desktop\FRST.txt
2014-09-22 17:00 - 2014-09-22 17:01 - 00000000 ____D () C:\FRST
2014-09-22 16:59 - 2014-09-22 16:59 - 01097728 _____ (Farbar) C:\Users\Niki\Desktop\FRST.exe
2014-09-22 16:59 - 2014-09-22 16:59 - 00112640 _____ (forum.viry.cz) C:\Users\Niki\Desktop\FRSTLauncher.exe
2014-09-21 16:42 - 2014-09-21 16:17 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-09-21 16:19 - 2014-09-21 16:44 - 00009636 _____ () C:\zoek-results.log
2014-09-21 16:17 - 2014-09-21 16:36 - 00000000 ____D () C:\zoek_backup
2014-09-21 16:17 - 2014-09-21 16:17 - 01290752 _____ () C:\Users\Niki\Desktop\zoek.exe
2014-09-20 18:33 - 2014-09-20 18:33 - 00003121 _____ () C:\Users\Niki\Desktop\AdwCleaner[S0].txt
2014-09-20 18:21 - 2014-09-20 18:28 - 00000000 ____D () C:\AdwCleaner
2014-09-19 19:56 - 2014-09-19 19:56 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-18 20:05 - 2014-09-22 16:57 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-18 20:04 - 2014-09-18 20:04 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-18 20:04 - 2014-09-18 20:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-18 20:04 - 2014-09-18 20:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-18 20:04 - 2014-09-18 20:04 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-09-18 20:04 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-18 20:04 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-18 20:04 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-18 20:03 - 2014-09-18 20:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Niki\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-16 17:54 - 2014-09-16 17:54 - 00013643 _____ () C:\Users\Niki\Desktop\info.txt
2014-09-16 17:36 - 2014-09-16 17:38 - 00000000 ____D () C:\rsit
2014-09-16 17:36 - 2014-09-16 17:37 - 00000000 ____D () C:\Program Files\trend micro
2014-09-15 21:45 - 2014-09-15 21:45 - 01924624 _____ (Hagel Technologies Ltd ) C:\Users\Niki\Downloads\DUMeter-Install.exe
2014-09-12 19:14 - 2014-09-14 15:34 - 00000000 ____D () C:\Users\Niki\Desktop\photos
2014-09-12 03:13 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 03:13 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 03:13 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 03:13 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 03:13 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 03:13 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 03:13 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 03:13 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 03:13 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 03:13 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 03:13 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 03:13 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 03:13 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 03:13 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 03:13 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 03:13 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 03:13 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 03:13 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 03:13 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 03:13 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 03:13 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 03:13 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 03:13 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 03:13 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 03:13 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 03:13 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 03:13 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 03:13 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 03:13 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 03:13 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 03:12 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-11 21:28 - 2014-09-11 21:28 - 00000000 ____D () C:\Users\Niki\AppData\Local\ESET
2014-09-11 20:51 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 20:50 - 2014-09-05 03:52 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 20:50 - 2014-09-05 03:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 20:50 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 20:50 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 20:50 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-09 22:05 - 2014-09-09 22:05 - 00000844 _____ () C:\Users\Niki\AppData\Local\recently-used.xbel
2014-08-28 08:46 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 08:46 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-22 17:01 - 2014-09-22 17:01 - 00011122 _____ () C:\Users\Niki\Desktop\FRST.txt
2014-09-22 17:01 - 2014-09-22 17:00 - 00000000 ____D () C:\FRST
2014-09-22 17:01 - 2012-07-20 20:25 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-22 16:59 - 2014-09-22 16:59 - 01097728 _____ (Farbar) C:\Users\Niki\Desktop\FRST.exe
2014-09-22 16:59 - 2014-09-22 16:59 - 00112640 _____ (forum.viry.cz) C:\Users\Niki\Desktop\FRSTLauncher.exe
2014-09-22 16:57 - 2014-09-18 20:05 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-22 16:57 - 2014-06-25 18:38 - 00000940 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf9093dca0eeef.job
2014-09-22 07:42 - 2012-07-21 01:34 - 01646728 _____ () C:\Windows\WindowsUpdate.log
2014-09-21 21:15 - 2009-07-14 06:34 - 00020432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-21 21:15 - 2009-07-14 06:34 - 00020432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-21 18:43 - 2012-07-23 20:49 - 00000932 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-21 16:47 - 2012-09-28 15:24 - 00000000 ____D () C:\Users\Niki\AppData\Roaming\Skype
2014-09-21 16:44 - 2014-09-21 16:19 - 00009636 _____ () C:\zoek-results.log
2014-09-21 16:44 - 2012-07-20 20:45 - 00000000 ____D () C:\Users\Niki\AppData\Roaming\ICQ
2014-09-21 16:43 - 2012-08-08 09:02 - 00260282 _____ () C:\Windows\PFRO.log
2014-09-21 16:43 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-21 16:43 - 2009-07-14 06:39 - 00058708 _____ () C:\Windows\setupact.log
2014-09-21 16:36 - 2014-09-21 16:17 - 00000000 ____D () C:\zoek_backup
2014-09-21 16:17 - 2014-09-21 16:42 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-09-21 16:17 - 2014-09-21 16:17 - 01290752 _____ () C:\Users\Niki\Desktop\zoek.exe
2014-09-20 22:42 - 2012-08-18 09:57 - 00000000 ____D () C:\Users\Niki\AppData\Roaming\uTorrent
2014-09-20 18:33 - 2014-09-20 18:33 - 00003121 _____ () C:\Users\Niki\Desktop\AdwCleaner[S0].txt
2014-09-20 18:28 - 2014-09-20 18:21 - 00000000 ____D () C:\AdwCleaner
2014-09-20 17:51 - 2012-07-21 11:42 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-20 17:51 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\addins
2014-09-19 19:56 - 2014-09-19 19:56 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-18 20:04 - 2014-09-18 20:04 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-18 20:04 - 2014-09-18 20:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-18 20:04 - 2014-09-18 20:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-18 20:04 - 2014-09-18 20:04 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-09-18 20:03 - 2014-09-18 20:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Niki\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-16 17:54 - 2014-09-16 17:54 - 00013643 _____ () C:\Users\Niki\Desktop\info.txt
2014-09-16 17:38 - 2014-09-16 17:36 - 00000000 ____D () C:\rsit
2014-09-16 17:37 - 2014-09-16 17:36 - 00000000 ____D () C:\Program Files\trend micro
2014-09-16 17:21 - 2012-09-28 15:24 - 00000000 ____D () C:\ProgramData\Skype
2014-09-15 21:46 - 2012-08-18 10:39 - 00000000 ____D () C:\Program Files\DU Meter
2014-09-15 21:46 - 2012-08-18 10:02 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DU Meter
2014-09-15 21:45 - 2014-09-15 21:45 - 01924624 _____ (Hagel Technologies Ltd ) C:\Users\Niki\Downloads\DUMeter-Install.exe
2014-09-14 19:09 - 2013-08-25 15:30 - 00000000 ____D () C:\Users\Niki\AppData\Roaming\Samsung
2014-09-14 19:09 - 2013-08-25 15:30 - 00000000 ____D () C:\Users\Niki\AppData\Local\Samsung
2014-09-14 19:05 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-14 18:54 - 2013-04-01 16:44 - 00000000 ____D () C:\Program Files\Golden FTP Server Pro
2014-09-14 18:53 - 2012-09-30 00:02 - 00000000 ____D () C:\Program Files\Codebox
2014-09-14 18:35 - 2012-07-20 19:43 - 01584554 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-14 15:34 - 2014-09-12 19:14 - 00000000 ____D () C:\Users\Niki\Desktop\photos
2014-09-12 19:17 - 2012-11-03 18:08 - 00000000 ____D () C:\Users\Niki\Desktop\Fotky
2014-09-12 04:21 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-12 03:12 - 2013-08-02 08:21 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 03:07 - 2014-05-08 07:50 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 03:07 - 2012-08-05 10:05 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-11 22:41 - 2013-09-24 19:09 - 00000000 ____D () C:\Users\Niki\AppData\Roaming\vlc
2014-09-11 21:28 - 2014-09-11 21:28 - 00000000 ____D () C:\Users\Niki\AppData\Local\ESET
2014-09-11 21:27 - 2012-10-19 21:18 - 00000000 ____D () C:\Users\Niki\Documents\The KMPlayer
2014-09-11 21:25 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-09-11 21:22 - 2013-09-24 19:09 - 00001024 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-09-11 21:22 - 2013-09-24 19:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-09-10 11:01 - 2012-07-20 20:25 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-10 11:01 - 2012-07-20 20:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-09 22:06 - 2014-04-15 22:52 - 00000000 ____D () C:\Users\Niki\.gimp-2.8
2014-09-09 22:05 - 2014-09-09 22:05 - 00000844 _____ () C:\Users\Niki\AppData\Local\recently-used.xbel
2014-09-05 03:52 - 2014-09-11 20:50 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 03:47 - 2014-09-11 20:50 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-31 18:50 - 2014-06-22 11:08 - 00000000 ____D () C:\FILMY-NEW
2014-08-29 10:50 - 2009-07-14 06:33 - 00286144 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 06:53 - 2012-07-20 20:40 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-23 03:46 - 2014-08-28 08:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 02:42 - 2014-08-28 08:46 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf9093dca0eeef.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: ESET NOD32 Antivirus 6.0 (Enabled - Up to date) {77DEAFED-8149-104B-25A1-21771CA47CD1}
AS: ESET NOD32 Antivirus 6.0 (Enabled - Up to date) {CCBF4E09-A773-1FC5-1F11-1A056723366C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Niki\Desktop" je 17965 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================

Re: Problem s virem JS/Kryptik.I

Napsal: 22 zář 2014 16:10
od vyosek
:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
CloseProcesses:

HKLM\...\Run: [Guard.Mail.ru.gui] => C:\Program Files\Guard-ICQ\GuardICQ.exe [1564368 2012-07-20] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [249064 2010-10-29] (Sun Microsystems, Inc.)
HKLM\...\Run: [NPSStartup] => [X]
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [ICQ] => C:\Program Files\ICQ7M\ICQ.exe [127040 2012-07-20] (ICQ, LLC.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files\DAEMON Tools Pro\DTAgent.exe [3111744 2012-04-26] (DT Soft Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe /preload
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c} - H:\iLinker.exe
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ICQ] => C:\Program Files\ICQ7M\ICQ.exe [127040 2012-07-20] (ICQ, LLC.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files\DAEMON Tools Pro\DTAgent.exe [3111744 2012-04-26] (DT Soft Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe /preload
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c} - H:\iLinker.exe

R2 Guard.Mail.ru; C:\Program Files\Guard-ICQ\GuardICQ.exe [1564368 2012-07-20] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

2014-09-22 17:01 - 2014-09-22 17:01 - 00011122 _____ () C:\Users\Niki\Desktop\FRST.txt
2014-09-22 16:59 - 2014-09-22 16:59 - 00112640 _____ (forum.viry.cz) C:\Users\Niki\Desktop\FRSTLauncher.exe
2014-09-21 16:42 - 2014-09-21 16:17 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-09-21 16:19 - 2014-09-21 16:44 - 00009636 _____ () C:\zoek-results.log
2014-09-21 16:17 - 2014-09-21 16:36 - 00000000 ____D () C:\zoek_backup
2014-09-21 16:17 - 2014-09-21 16:17 - 01290752 _____ () C:\Users\Niki\Desktop\zoek.exe
2014-09-20 18:33 - 2014-09-20 18:33 - 00003121 _____ () C:\Users\Niki\Desktop\AdwCleaner[S0].txt
2014-09-20 18:21 - 2014-09-20 18:28 - 00000000 ____D () C:\AdwCleaner
2014-09-16 17:54 - 2014-09-16 17:54 - 00013643 _____ () C:\Users\Niki\Desktop\info.txt
2014-09-16 17:36 - 2014-09-16 17:38 - 00000000 ____D () C:\rsit
2014-09-16 17:36 - 2014-09-16 17:37 - 00000000 ____D () C:\Program Files\trend micro
C:\Program Files\Guard-ICQ

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf9093dca0eeef.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Hosts:
EmptyTemp:
Reboot:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt

Re: Problem s virem JS/Kryptik.I

Napsal: 22 zář 2014 16:26
od qantas
přikládám FIXLOG :

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 21-09-2014 01
Ran by Niki at 2014-09-22 17:17:35 Run:1
Running from C:\Users\Niki\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
CloseProcesses:

HKLM\...\Run: [Guard.Mail.ru.gui] => C:\Program Files\Guard-ICQ\GuardICQ.exe [1564368 2012-07-20] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [249064 2010-10-29] (Sun Microsystems, Inc.)
HKLM\...\Run: [NPSStartup] => [X]
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [ICQ] => C:\Program Files\ICQ7M\ICQ.exe [127040 2012-07-20] (ICQ, LLC.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files\DAEMON Tools Pro\DTAgent.exe [3111744 2012-04-26] (DT Soft Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe /preload
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c} - H:\iLinker.exe
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ICQ] => C:\Program Files\ICQ7M\ICQ.exe [127040 2012-07-20] (ICQ, LLC.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files\DAEMON Tools Pro\DTAgent.exe [3111744 2012-04-26] (DT Soft Ltd)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe /preload
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c} - H:\iLinker.exe

R2 Guard.Mail.ru; C:\Program Files\Guard-ICQ\GuardICQ.exe [1564368 2012-07-20] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

2014-09-22 17:01 - 2014-09-22 17:01 - 00011122 _____ () C:\Users\Niki\Desktop\FRST.txt
2014-09-22 16:59 - 2014-09-22 16:59 - 00112640 _____ (forum.viry.cz) C:\Users\Niki\Desktop\FRSTLauncher.exe
2014-09-21 16:42 - 2014-09-21 16:17 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-09-21 16:19 - 2014-09-21 16:44 - 00009636 _____ () C:\zoek-results.log
2014-09-21 16:17 - 2014-09-21 16:36 - 00000000 ____D () C:\zoek_backup
2014-09-21 16:17 - 2014-09-21 16:17 - 01290752 _____ () C:\Users\Niki\Desktop\zoek.exe
2014-09-20 18:33 - 2014-09-20 18:33 - 00003121 _____ () C:\Users\Niki\Desktop\AdwCleaner[S0].txt
2014-09-20 18:21 - 2014-09-20 18:28 - 00000000 ____D () C:\AdwCleaner
2014-09-16 17:54 - 2014-09-16 17:54 - 00013643 _____ () C:\Users\Niki\Desktop\info.txt
2014-09-16 17:36 - 2014-09-16 17:38 - 00000000 ____D () C:\rsit
2014-09-16 17:36 - 2014-09-16 17:37 - 00000000 ____D () C:\Program Files\trend micro
C:\Program Files\Guard-ICQ

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf9093dca0eeef.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Guard.Mail.ru.gui => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\NPSStartup => value deleted successfully.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ICQ => value deleted successfully.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Pro Agent => value deleted successfully.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPreload => value deleted successfully.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPDLR.exe => value deleted successfully.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => value deleted successfully.
"HKU\S-1-5-21-3225356497-680086398-3201549040-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ea58eae-c658-11e3-95a6-eb1766f6c95c}" => Key deleted successfully.
"HKCR\CLSID\{5ea58eae-c658-11e3-95a6-eb1766f6c95c}" => Key not found.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\ICQ => Value not found.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Pro Agent => Value not found.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPreload => Value not found.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPDLR.exe => Value not found.
HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => Value not found.
"HKU\S-1-5-21-3225356497-680086398-3201549040-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c}" => Key not found.
"HKCR\CLSID\{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {5ea58eae-c658-11e3-95a6-eb1766f6c95c}" => Key not found.
Guard.Mail.ru => Service deleted successfully.
Synth3dVsc => Service deleted successfully.
tsusbhub => Service deleted successfully.
VGPU => Service deleted successfully.
C:\Users\Niki\Desktop\FRST.txt => Moved successfully.
C:\Users\Niki\Desktop\FRSTLauncher.exe => Moved successfully.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\Niki\Desktop\zoek.exe => Moved successfully.
C:\Users\Niki\Desktop\AdwCleaner[S0].txt => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Users\Niki\Desktop\info.txt => Moved successfully.
C:\rsit => Moved successfully.
C:\Program Files\trend micro => Moved successfully.
C:\Program Files\Guard-ICQ => Moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf9093dca0eeef.job => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 651.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====

Re: Problem s virem JS/Kryptik.I

Napsal: 22 zář 2014 18:56
od vyosek
Tak jeste uklidime :James008:

:arrow: T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: Napiste jak se chova PC
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz